Chapter 1. View key usage metrics with automation dashboard

Procedure

1. Download the latest installer tar file from access.redhat.com. Navigate to Downloads > Red Hat Ansible Automation Platform Product Software.
2. Copy the installation source file to your RHEL 9 or RHEL 10 host.

3. Extract the installation source. This will require ~500Mb. of disk space. Throughout this example we will use the ec2-user home directory: /home/<username>.

   tar -xzvf ansible-automation-dashboard-containerized-setup-bundle-0.1-x86_64.tar.gz
   cd ansible-automation-dashboard-containerized-setup/

4. Install the required ansible-core package.

   cd ansible-automation-dashboard-containerized-setup
   sudo dnf install ansible-core

5. Create an application client_id/client_secret in your Ansible Automation Platform instance:

   1. Create an OAuth2 application using the following steps :

      1. For Ansible 2.4:

         • Navigate to https://AAP_CONTROLLER_FQDN/#/applications

      2. For Ansible 2.5 and 2.6:

         • Navigate to https://AAP_GATEWAY_FQDN/access/applications

      3. Add the following information:

         • Name: automation-dashboard-sso
         • Authorization grant type: authorization-code
         • Organization: Default
         • Redirect URIs: https://AUTOMATION_DASHBOARD_FQDN/auth-callback

         • Client type: Confidential

           Note

           The values for Name, Organization, and HTTPS port number for Ansible Automation Platform are configurable. The examples provided in this document assume use of port 443.

   2. Save the client_id and client_secret information inputs into the inventory file.

   3. Create an Ansible Automation Platform access token:

      1. Navigate to https://AAP_GATEWAY_FQDN/#/users/<id>/tokens, and create a token using the following information:

         • OAuth application: automation-dashboard-sso
         • Scope: read
      2. Store the access token and refresh token values. clusters.yaml uses these tokens.

6. Copy the example inventory and change it before running the installation program.

   cp -i inventory.example inventory
   vi inventory

   Important
   • This is an example tested inventory containing default values for Ansible Automation Platform 2.4, 2.5, and 2.6.

   • You must change the following values to use this inventory configuration in your environment:

     • Change the RHEL 9 or RHEL 10 host occurrences from host.example.com to your FQDN host
     • Change the phrase TODO to match your passwords within all _admin_password or _pg_password values.
     • Change the dashboard_pg_host value to the IP address or DNS name of the database server.
     • If your automation dashboard images are hosted in a different registry than your core components, you must provide separate login credentials using the registry_<VARIABLE_NAME>_aap_automation_dashboard variables.
   • For more information, see the Inventory variables section of this document.

   # This is our automation dashboard front-end application
   [automationdashboard]
   host.example.com ansible_connection=local
   
   # These are required vars for the installation and should not be removed
   [automationdashboard:vars]
   # Configure AAP OAuth2 authentication.
   # aap_auth_provider_name - name as shown on login page.
   aap_auth_provider_name=Ansible Automation Platform
   # aap_auth_provider_protocol - http or https
   aap_auth_provider_protocol=https
   # AAP version - 2.4, 2.5 or 2.6
   aap_auth_provider_aap_version=2.5
   # aap_auth_provider_host - AAP IP or DNS name, with optional port
   aap_auth_provider_host=my-aap.example.com
   # aap_auth_provider_check_ssl - enforce TLS check or not.
   aap_auth_provider_check_ssl=true
   # aap_auth_provider_client_id and aap_auth_provider_client_secret -
   # they are obtained from AAP when OAuth2 application is created in AAP.
   aap_auth_provider_client_id=TODO
   aap_auth_provider_client_secret=TODO
   
   
   # Specify amount of old data to synchronoize after installation.
   # The initial_sync_days=N requests N days of old data, counting from "today".
   # The initial_sync_since requests data from the specified data until "today".
   # If both are specified, the initial_sync_since will be used.
   initial_sync_days=1
   # initial_sync_since=2025-08-08
   
   # Hide warnings when insecure https request are made.
   # Use this if your AAP uses self-signed TLS certificate.
   # show_urllib3_insecure_request_warning=False
   
   # Force clean install-like
   # dashboard_update_secret=true
   
   # HTTP/HTTPS settings
   # nginx_disable_https=true
   # Change nginx_http_port or nginx_https_port if you want to access dashboard on a different TCP port.
   # nginx_http_port=8083
   # nginx_https_port=8447
   # TLS certificate configuration
   # The dashboard_tls_cert needs:
   #   - contain server certificate, intermediate CA certificates and root CA certificate.
   #   - the server certificate must be the first one in the file.
   # dashboard_tls_cert=/path/to/tls/dashboard.crt
   # dashboard_tls_key=/path/to/tls/dashboard.key
   
   # Enable Django DEBUG.
   # django_debug=True
   
   [database]
   host.example.com ansible_connection=local
   [redis]
   host.example.com ansible_connection=local
   
   [all:vars]
   redis_mode=standalone
   
   [all:vars]
   postgresql_admin_username=postgres
   postgresql_admin_password=TODO
   
   # Standard registry settings
   # registry_username=
   # registry_password=
   
   # Dashboard Registry - optional (use if dashboard images are in a different registry)
   # registry_url_aap_automation_dashboard=quay.io
   # registry_ns_aap_automation_dashboard=aap
   # registry_username_aap_automation_dashboard=TODO
   # registry_password_aap_automation_dashboard=TODO
   # registry_tls_verify_aap_automation_dashboard=True
   
   # AAP Dashboard - mandatory
   # --------------------------
   dashboard_pg_containerized=True
   dashboard_admin_password=TODO
   # The value of dashboard_pg_host needs to resolve to an IP address of the database.
   # It cannot be localhost or 127.0.0.1.
   # It can be IP address of the server.
   
   dashboard_pg_host=host.example.com
   dashboard_pg_username=aapdashboard
   dashboard_pg_password=TODO
   dashboard_pg_database=aapdashboard
   
   bundle_install=true
   #
   # Relevant if bundle_install=false
   # Set container_image_update to True to fetch most recent container images from registry.
   # container_image_update=True
   #
   # Relevant if bundle_install=true
   # <full path to the bundle directory>
   bundle_dir='{{ lookup("ansible.builtin.env", "PWD") }}/bundle'
   # AAP Dashboard - optional
   # --------------------------
   # Set to True to expose Django admin page.
   # nginx_dashboard_admin_exposed=False

7. Install the required Ansible collections. You must complete this step to prevent module resolution errors during the installation.

   ansible-galaxy collection install -r requirements.yml

8. Run the installation program.

   ansible-playbook -i inventory ansible.containerized_installer.dashboard_install --ask-become-pass

Procedure

1. Configure a personal access token. For more information, see Configuring access to external applications with token-based authentication.

2. Create or update the clusters.yaml file. You must include the access_token, refresh_token, client_id, and client_secret to enable persistent authentication and automatic token rotation.

   clusters:
     - protocol: https
       address: <aap_controller_url>
       port: 443
       access_token: <access_token_string>
       refresh_token: <refresh_token_string>
       client_id: <client_id_string>
       client_secret: <client_secret_string>
       verify_ssl: false
       name: <unique_cluster_name>

   Configuring TLS verification

   When configuring the verify_ssl parameter, choose the setting that matches your Ansible Automation Platform certificate type:

   • Commercial certificates: Set verify_ssl: true.

   • Self-signed certificates: Set verify_ssl: false.

     Note

     The automation dashboard cannot verify self-signed certificates against a custom Certificate Authority (CA).

3. You can add one or more Ansible Automation Platform instances (of the same Ansible Automation Platform version) into the automation dashboard configuration for pulling and combining data by using the following:

   Note

   If you only have one Ansible Automation Platform instance, then remove the second entry.

   ---
   clusters:
     - protocol: https			<--- Normally https
       address: my-aap.example.com  <--- Can use IP or FQDN without http(s)://
       port: 443				<--- Normally 443
       access_token: sampleToken	<--- Your preconfigured Ansible Automation Platform read access token
     Platform read access token
       refresh_token: myRefreshToken
       client_id: myClientID
       client_secret: myClientSecret
       verify_ssl: false		<--- Can be used when using self signed certs
       sync_schedules:
         - name: Every 5 minutes sync
           rrule: DTSTART;TZID=Europe/Ljubljana:20250630T070000 FREQ=MINUTELY;INTERVAL=5
           enabled: true
    # If there is one Ansible Automation Platform instance, then remove the second entry below.
     # Alternately. If there is more than one AAP instance to connect, copy additional entries.
     - protocol: https
       address: aap2.example.com
       port: 443
       access_token: WRn2swiqg5spEwUndDkrJoCeg4Qwuw
       verify_ssl: true
       sync_schedules:
         - name: Every 5 minutes sync
           rrule: DTSTART;TZID=Europe/Ljubljana:20250630T070000 FREQ=MINUTELY;INTERVAL=5
          enabled: true

   Note

   The access_token, refresh_token, and client_secret are stored in the automation dashboard database. These values are encrypted for security.

4. Load and activate your automation dashboard configuration. You must copy the configuration file to the container’s /tmp/ directory. The system automatically removes the file from the container after successful processing.

   podman cp clusters.yaml automation-dashboard-web:/tmp
   podman exec -it automation-dashboard-web /venv/bin/python manage.py setclusters /tmp/clusters.yaml

   Note

   If the system cannot remove the file from the /tmp/ directory, it displays an error message and continues running.

   Note

   Token Rotation: The automation dashboard rotates tokens internally for security but does not update your local clusters.yaml file. If you must re-run the setclusters command later, your defined tokens might be expired.

   To retrieve the current valid tokens, run the following command and save the output to a new file:

   podman exec -it automation-dashboard-web /venv/bin/python manage.py getclusters --decrypt > clusters_current.yaml

Procedure

1. Download the latest installation bundle from access.redhat.com. Navigate to Downloads > Red Hat Ansible Automation Platform Product Software.
2. Extract the bundle to a new directory.
3. Copy the inventory file from your previous installation directory to the new directory.

4. Edit the inventory file to include the mandatory Redis configuration. You must add a [redis] group and define the redis_mode variable:

   Note

   The inventory file lines prefixed with + must be added when upgrading your automation dashboard.

    [database]
   host.example.com ansible_connection=local
   
   +[redis]
   +host.example.com ansible_connection=local
   +
    [all:vars]
   +redis_mode=standalone
   +
    postgresql_admin_username=postgres
    postgresql_admin_password=TODO
    # registry_username=

5. Run the installation playbook from the new directory:

   ansible-galaxy collection install -r requirements.yml
   ansible-playbook -i inventory ansible.containerized_installer.dashboard_install --ask-become-pass

6. Update your clusters.yaml file. You must add the refresh_token, client_id, and client_secret variables to your existing cluster configurations.

   Note

   For instructions on obtaining these values, see Integrating automation dashboard with your Ansible Automation Platform.

7. Apply the updated configuration to the dashboard. You must copy the configuration file to the container’s /tmp/ directory:

   podman cp clusters.yaml automation-dashboard-web:/tmp/
   podman exec -it automation-dashboard-web /venv/bin/python manage.py setclusters /tmp/clusters.yaml

Verification

1. Retrieve the current cluster configuration:

   podman exec -it automation-dashboard-web /venv/bin/python ./manage.py getclusters --decrypt

2. Verify that the output displays the content from your clusters.yaml file, including the access_token, refresh_token, client_id, and client_secret fields.

Procedure

1. In the Monthly AAP cost field, enter the monthly cost of running the Ansible Automation Platform. This value includes license, labor, and infrastructure costs to run Ansible Automation Platform. It is used to calculate the automation savings.
2. In the Hourly rate for manually running the job ($) field, enter the hourly labor cost used to estimate what it would cost to run these jobs manually. This is used to calculate manual cost and savings.

3. Optional: Select Time taken to create automation to include the estimated time spent creating or authoring the automation (for example, writing playbooks, setting up jobs) before it could be run.

   Automation dashboard calculates the following data points based on your inputs:

   • Cost of manual automation: Total cost if all jobs were run manually.
   • Cost of automated execution: Total cost of running jobs on Ansible Automation Platform.
   • Total savings/cost avoided: Difference between manual and automated cost.
   • Total hours saved/avoided: Time saved by automation vs manual execution.
   • Time taken to manually execute (min): Estimated manual execution time in minutes.
   • Time taken to create automation (min): Estimated time spent creating or authoring the automation (for example, writing playbooks, setting up jobs) before it could be run. Included in cost when the switch above is on.